for security use cases, large error messages, etc.. .text is an important aspect in searching.

pro(s):

• faster searches
• severely reduces impact on the backend (and ultimately customer/user experience)

con(s):

• increases storage

temporary proposal to meet in the middle (for now) instead of adding .text into the dynamic template for all strings fields VS having no .text fields at all
ECS and thus corresponding beats index templates have .text field for high value/impacting fields. List of fields off the top of my head would be:

• process.executable.text
• process.args.text
• url.original
• user.email
• user_agent.original
• error.stack_trace
• file.path
• host.name
• any .user.name fields
• any .domain fields
• any .as.organization.name fields
• http.request.body.content
• http.response.body.content
• os.name.full

existing ECS reference:
#340
#104